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IN THE CLAIMS 

This listing of claims will replace all prior versions and listings of claims in the 
application. 

1. (Original) A node of a network maintaining an instance of an intrusion 
prevention system, the node comprising: 

a memory module for storing data in machine-readable format for retrieval and 
execution by a central processing unit; and 

an operating system comprising a network stack comprising a protocol driver, a 
media access control drivel and an instance of the intnision prevention system 
implemented as an intermediate driver and bound to the protocol driver and the media 
access control driver, the imni^on prevention system comprising an associative process 
engine and an input/output control layer, the input/oxitput control layer operable to 
receive at least one of a plurality of machine-readable network-e^loit signatures from a 
database and provide the at least one machine-readable netwoifc-^lott signatures to the 
associative pix»cess engine, the associative process engine operable to compare a padcet 
mth the at least one machine-readable network-exploit sigiiature and d^iermine a 
corre^ondence between the padket and the at least one machine-readable networic- 
exploit signature. 

2. (Or^al) The node according to claim 1, wherein the database is 
maintained in a storage device of the node. 

3. (Origidal) The node according to claim 1, wherein each of the plurality of 
machine-readable network-exploit signatures comprise a respective directive that defines 
instructions to be executed upon determination of a correspondence between the packet 
and the re^>ective exploit signature. 

4. (Ori^al) The node according to claim 1, wherein, upon determination of 
a correspondence between the packet and two or more of the plurality of machine- 
readable network-exploit signatures, each of the directives of the two or more machine- 
readable network-exploit signatures are executed by the intrusion prevention system. 
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5. (Originiil) The node according to claim 1, wherein, upon determination of 
a correspondence between the packet and two or more of the plurality of machine- 
readable network-exploit signatures, an alternative dkective is executed, the ahemative 
directive dependent upon the combination of the two or more netwoiic-exploits signatures 
having a correspondence with the packet. 

6. (Origmal) A method of analyzing a packet at a node of a network by an 
intrusion prevention system executed by the node, comprising: 

reading the packet by the intru^on prevention system; 

comparing the packet with a plurality of machine^readable netwoifc-exploit 
signatures; and 

determining a correspondence between the packet and at least two of the plurality 
of machine-readable network-exploit signatures. 

7. (Original) The method according to claim 6, further conqmsing 
generating a record of the at least two of the plurality of machine-readable network- 
exploit signatures with which a correspondence with the packet is made. 

8- (Originai) The method according to claim 7, fiirther comprising 
transmitting the record to a management node coimected to the network. 

9. (Oiigidal) The method accordiiig to claim 7, fiirther comprising logging 
the record in a database. 

10. (Origiiial) The method according to claim 6, fiuther comprising 
executing, by the intrusion protection system, a respective directive of each of the at least 
two machine-readable signatures determined to correspond with the packet. 

11. (Original) The method according to daim 6» fiirther comprising 
executing, by the intrusion protection system, at least one directive of at least one of the 
machine-readable n€twork-€5q>loit signatures of the record drtermined to have a 
correspondence with the packet. 
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12. (Original) The method according to dium 6, fuither comprising 
executing, by the intrusion protection system, an alternative directive dependent on the 
record of machine-readable signatures determined to have a coinespondence with the 
packet. 

13. (Cnrrentty amended) A computer-readable medium having stored 
thereon a set of instructions to be executed, the set of instructions, when ejcecuted by a 
processor, cause the processor to perform a compute method of: 

comparing a packet with a plurality of machine^eadable network-exploit 
signatures; 

determining a correspondence between the packet and at least fivo ft-subset of the 
plurality of machine-readable network-exploit signatures; and 

generating a record of the at least two signatures subset with which the 
correspondence is made. 

14. (Oiigiiial) The computer readable medium accordiiig to claim 13, further 
comprising a set of instructions that cause, when executed by the processor, the processor 
to perform a computer method of: 

det^mining a corre^ondence between the packet and a subset of the plurality of 
machine-readable network-exploit signatures, each machine-readable network-exploit 
signature comprising a directive; and 

executing, by the processor, each directive of the record of machine-readiable 
signatures. 

15. (Currently amended) The computer readable medhmi according to claim 
13, further comprising a set of instructions that cause, when executed by the processor^ 
the processor to perform a con^mter method of executing a directive dependent on the 
corresponding machme-readabie network-exploit signatures within th e sub set. 
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